Technical impact
The vulnerability arises from incorrect permission checks in Octopus Server. As a result, any authenticated user can invoke a particular API endpoint to make server‑level changes, even though the system reports an error. This flaw enables modification of configuration that should be restricted to privileged users, potentially compromising the integrity of the deployment environment.
Affected Systems
The affected product is Octopus Deploy Octopus Server. Specific product versions are not provided, so all currently deployed instances of Octopus Server are potentially vulnerable until a patch that restores proper access control is applied. The issue is limited to the server component and does not affect the client or agent.
Risk and Exploitability
The CVSS score of 6.0 indicates moderate severity, and the EPSS score is less than 1%, suggesting a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker must already possess valid credentials to exploit the flaw. Once authenticated, the attacker can manipulate the server using the susceptible API, leading to unintended configuration changes that could compromise system integrity. The exploitation does not require remote code execution, but the impact on system integrity could be significant.
